This article explains how the core themes of NCSC small business guidance map to concrete actions that a small organisation can take without needing a large security team.
1. Backing up your data
NCSC emphasises the importance of backups. In practice, this means:
- Identifying which systems and data are critical to your operation.
- Ensuring daily or at least regular backups for those systems.
- Storing at least one backup copy separate from your main environment.
- Testing restores so you know they work before you need them urgently.
2. Protecting your organisation from malware
The guidance recommends a layered approach rather than relying on a single product:
- Enable reputable endpoint protection on all managed devices.
- Keep systems and applications updated to close known vulnerabilities.
- Restrict local admin rights so staff cannot install arbitrary software.
- Limit use of USB sticks and unmanaged storage devices.
3. Keeping smartphones and tablets safe
Mobile devices now hold access to email, collaboration platforms, and sometimes line of business applications. Practical steps include:
- Require a screen lock on all devices that access business data.
- Enable device encryption where supported.
- Use mobile device management where possible to enforce basic standards.
- Ensure staff know how to report a lost or stolen device promptly.
4. Using passwords wisely
NCSC guidance has moved away from frequent forced changes and toward longer, unique passphrases. For small organisations:
- Adopt a password manager for staff.
- Encourage passphrases rather than short complex strings.
- Turn on MFA for high value services such as email, VPN, and cloud portals.
5. Avoiding phishing attacks
Phishing remains a major route into small organisations. Practical measures:
- Use email filtering that includes phishing and malware scanning.
- Run short awareness sessions to show staff real world phishing examples. is addressed
- Establish a simple reporting route, such as a central mailbox for suspicious messages.
6. Aligning NCSC advice with your own roadmap
NCSC material is deliberately vendor neutral and high level. To make it work in your organisation, it needs to be translated into a roadmap that fits your size and technology mix.
The Baseline Security Sprint uses NCSC principles alongside other recognised frameworks but focuses on implementation, documentation, and operational routines.
Next step: if you want your environment aligned with NCSC guidance in a structured and measurable way, consider a short discussion to see whether a sprint format would help you move from guidance to implementation.